Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
The KDC SHOULD look up the account using the cname. If the account is not found and the cname name-type is NT-X500-PRINCIPAL, the KDC locates the account in the account database using the explicit mapping fields. Implementations of PKCA KDCs which use Active Directory for the account database when the userAccountControl attribute ([MS-ADA3] section 2.342) bit WT or ST ([MS-ADTS] section 2.2.16) is:
TRUE: validate certificate mapping using the SAN DNSName field.<21>
Both FALSE: validate certificate mapping using the SAN UPNName field first, then try explicit mapping.
If the account is not found, the KDC returns KDC_ERR_C_PRINCIPAL_UNKNOWN.